Security advisories

high2025-10-14

CVE-2025-62157-Argo Workflow may expose artifact repository credentials

argoproj/argo-workflows · GHSA-c2hv-4pfj-mm2r

high2025-10-14

CVE-2025-59288-Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate

microsoft/playwright · GHSA-7mvr-c777-76hp

high2025-10-14

CVE-2025-59250-JDBC Driver for SQL Server has improper input validation issue

microsoft/mssql-jdbc · GHSA-m494-w24q-6f7w

high2025-10-14

CVE-2025-62156-Argo Workflow has a Zipslip Vulnerability

argoproj/argo-workflows · GHSA-p84v-gxvw-73pf

medium2025-10-14

CVE-2024-44088-Apache Geode web-api is vulnerable to Cross-site Scripting

apache/geode · GHSA-w595-4975-gm3h

medium2025-10-14

CVE-2025-62251-Liferay has Incorrect Permission Assignment for Critical Resource

liferay/liferay-portal · GHSA-j4f7-gj7q-xg9m

medium2025-10-13

CVE-2025-62365-LibreNMS is vulnerable to Reflected-XSS in `report_this` function

librenms/librenms · GHSA-86rg-8hc8-v82p

medium2025-10-13

CVE-2025-62252-Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key

liferay/liferay-portal · GHSA-pfwq-mr9g-gq6m

medium2025-10-13

CVE-2025-62246-Liferay Mentions Web is Vulnerable to Cross-site Scripting

liferay/liferay-portal · GHSA-mj68-2xr5-28xh

medium2025-10-13

CVE-2025-62242-Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key

liferay/liferay-portal · GHSA-3cm9-jrf5-h2cx

low2025-10-13

tracexec has `env` command argument injection via environment variables starting with dash in traced exec events

kxxt/tracexec · GHSA-6fgx-x7m2-74qm

high2025-10-13

CVE-2025-61688-Omni vulnerable to information leak via API

siderolabs/omni · GHSA-77r9-w39m-9xh5

medium2025-10-13

CVE-2025-59836-Omni is Vulnerable to DoS via Empty Create/Update Resource Requests

siderolabs/omni · GHSA-4p3p-cr38-v5xp

high2025-10-13

CVE-2025-7707-llama-index has Insecure Temporary File

run-llama/llama_index · GHSA-rg9h-vx28-xxp5

medium2025-10-13

CVE-2025-62243-Liferay Publications is vulnerable to Incorrect Authorization

liferay/liferay-portal · GHSA-894w-w643-qvxv

high2025-10-13

CVE-2025-11695-MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string

mongodb/mongo-rust-driver · GHSA-3p6w-gv5g-xjw9

medium2025-10-13

CVE-2025-62244-Liferay Publications vulnerable to Authorization Bypass Through User-Controlled Key

liferay/liferay-portal · GHSA-2hfj-jv6q-762v

medium2025-10-13

CVE-2025-62378-CommandKit has incorrect command name exposure in context object for message command aliases

underctrl-io/commandkit · GHSA-fhwm-pc6r-4h2f

high2025-10-13

CVE-2025-48043-Ash Framework: Filter authorization misapplies impossible bypass/runtime policies

ash-project/ash · GHSA-7r7f-9xpj-jmr7

medium2025-10-13

CVE-2025-11183-QGIS QWC2 Cross-Site Scripting vulnerability

qgis/qwc2 · GHSA-gxp8-m5rq-3m38